Dockerfile.release

# Release Dockerfile - packages pre-built binaries
# Used by CI/CD after cross-compilation
#
# Base image: Google Distroless (cc-debian12)
# Distroless provides a minimal, secure execution environment with no shell, 
# package manager, or standard utilities. It runs as nonroot by default.
#
# Alternatives:
#   FROM debian:bookworm-slim    (Standard Debian, includes shell for debugging)
#   FROM dhi.io/debian-base      (Hardened Debian, includes shell)

FROM gcr.io/distroless/cc-debian12
WORKDIR /app

# Lets the server warn when asked to bind loopback, which is unreachable
# through the container port mapping
ENV HONE_IN_CONTAINER=1

# Copy the correct binary based on target platform
# Binary must already be executable (set in CI)
ARG TARGETARCH
COPY binaries/${TARGETARCH}/hone /app/hone

# Copy frontend assets
COPY ui/dist /app/ui/dist

EXPOSE 3000
ENTRYPOINT ["/app/hone"]
CMD ["serve", "--host", "0.0.0.0", "--static-dir", "/app/ui/dist", "--db", "/data/hone.db"]